PT-2021-6331 · Microsoft · Office Visio

Khangkito + 1 · Published 2021-09-14 · Updated 2023-12-28 · CVE-2021-38654

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Office Visio (affected versions not specified)

Description The issue is related to an improper validation of array index in Microsoft Office Visio, which can lead to remote code execution. This is due to incorrect array indexing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

BDU:2022-01335

CVE-2021-38654

ZDI-21-1081

Affected Products

Office Visio

References · 10

• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-38654 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-1081 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-38654 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38654 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38654 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01335 · Security Note
• https://t.me/cvenotify/20955 · Telegram Post
• https://t.me/cvenotify/21420 · Telegram Post
• https://t.me/cvenotify/20958 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021091444 · Note